Winapp2.ini additions

[Winapp2.ini]

28 minutes ago, PICPro said:

Just a report in case you want to add support for this:

In "winapp2oolXP.exe", I have a computer here that comes up with unable to identify operating system version when trying to trim and says to report the following:
out: 5.2

This is a Windows XP Professional 64 bit service pack 2 computer. Trim.bat works but winapp2ool.exe would be a lot nicer. Regular winapp2ool.exe doesn't run on this computer.

wow! does this build work? https://github.com/MoscaDotTo/Winapp2/blob/Branch1/winapp2ool/winapp2oolXP.exe

I thought it might be a quick fix so I just targeted that one change, this version of winapp2ool xp may be otherwise unpolished. if things seem weird let me know, and definitely let me know if it crashes still

[APMichael]

@ricktendo64: Many thanks for your reply.

Winapp2.ini update:
https://github.com/MoscaDotTo/Winapp2/commit/a395bc93477a182494e6d64dffd513ecae8a719e

[PICPro]

wow! does this build work? https://github.com/MoscaDotTo/Winapp2/blob/Branch1/winapp2ool/winapp2oolXP.exe

Unfortunately, it does not: "not a valid Win32 application", same as trying to run regular Winapp2ool.exe. Comes up with "not a valid win32 applicaion" both in XP64 and regular XP.

[Winapp2.ini]

1 hour ago, PICPro said:

Unfortunately, it does not: "not a valid Win32 application", same as trying to run regular Winapp2ool.exe. Comes up with "not a valid win32 applicaion" both in XP64 and regular XP.

 

I think this might just be a build configuration issue, I'll tinker with visual studio and see if I can get it built correctly

[APMichael]

Winapp2.ini update:
https://github.com/MoscaDotTo/Winapp2/commit/57ffa85d23ab869dd1e01e5d42a5b13aac95aeb2

Winapp3.ini update:
https://github.com/MoscaDotTo/Winapp2/commit/f0c1ffa59c9380e1e4afb42da8b9a81e90422930

[dvdbane]

Hi
is it safe to delete file from this folder and is this related to Microsoft Office Isolated Conversion Environment as the first location got word file and 2nd location got excel file?
C:\Users\User\AppData\Local\Packages\oice_15_974fa576_32c1d314_1b36\AC\Temp

C:\Users\User\AppData\Local\Packages\oice_15_974fa576_32c1d314_2d13\AC\Temp

Windows 8.1, Office 2013

[MS Office *]
LangSecRef=3021
Detect1=HKCU\Software\Microsoft\Office\11.0
Detect2=HKCU\Software\Microsoft\Office\12.0
Detect3=HKCU\Software\Microsoft\Office\14.0
Detect4=HKCU\Software\Microsoft\Office\15.0
Detect5=HKCU\Software\Microsoft\Office\16.0
Default=False
FileKey1=%AppData%\Microsoft\Document Building Blocks|*.*|RECURSE
FileKey2=%AppData%\Microsoft\Office|*.tmp|RECURSE
FileKey3=%AppData%\Microsoft\OIS|Toolbars.dat
FileKey4=%AppData%\Microsoft\UProof|*.bin;*.XML
FileKey5=%Documents%|~*.ppt;~*.pptx;~*.doc;~*.docx|RECURSE
FileKey6=%LocalAppData%\Microsoft Help|*.*
FileKey7=%LocalAppData%\Microsoft\Office\*|OneNoteOfflineCache.onecache
FileKey8=%LocalAppData%\Microsoft\Office\OTele|*.*|RECURSE
FileKey9=%LocalAppData%\Microsoft\OneNote\*|OneNoteOfflineCache.onecache
FileKey10=%LocalAppData%\Microsoft\OneNote\*\cache|*.*|RECURSE
FileKey11=%LocalAppData%\Microsoft\OneNote\*\OneNoteOfflineCache_Files|*.*|RECURSE
FileKey12=%LocalAppData%\Packages\oice_*\AC\Temp|*.*|RECURSE
FileKey13=%SystemDrive%|propfix.log
FileKey14=%WinDir%\System32\config\systemprofile\AppData\Local\Microsoft\Office\OTele|*.*|RECURSE
FileKey15=%WinDir%\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Office\OTele|*.*|RECURSE
RegKey1=HKCU\Software\Microsoft\Office\11.0\MSE|LastLoadedSolution
RegKey2=HKCU\Software\Microsoft\Office\11.0\MSE\FileMRUList
RegKey3=HKCU\Software\Microsoft\Office\11.0\MSE\ProjectMRUList
RegKey4=HKCU\Software\Microsoft\Office\11.0\MSE\SolutionMRUList
RegKey5=HKCU\Software\Microsoft\Office\12.0\Common\Internet|UseRWHlinkNavigation
RegKey6=HKCU\Software\Microsoft\Office\12.0\Word\Reading Locations
RegKey7=HKCU\Software\Microsoft\Office\14.0\Common\Internet|UseRWHlinkNavigation
RegKey8=HKCU\Software\Microsoft\Office\14.0\Word\Reading Locations
RegKey9=HKCU\Software\Microsoft\Office\15.0\Common\Internet|UseRWHlinkNavigation
RegKey10=HKCU\Software\Microsoft\Office\15.0\Word\Reading Locations
RegKey11=HKCU\Software\Microsoft\Office\16.0\Common\Internet|UseRWHlinkNavigation
RegKey12=HKCU\Software\Microsoft\Office\16.0\Word\Reading Locations
RegKey13=HKCU\Software\Microsoft\Office\Common|FontBmpCache
RegKey14=HKCU\Software\Microsoft\OfficeCustomizeWizard\12.0\RecentFileList
RegKey15=HKCU\Software\Microsoft\OfficeCustomizeWizard\14.0\RecentFileList
RegKey16=HKCU\Software\Microsoft\OfficeCustomizeWizard\15.0\RecentFileList
RegKey17=HKCU\Software\Microsoft\OfficeCustomizeWizard\16.0\RecentFileList

add fk12

[Andavari]

Note: This is not a submission for inclusion into Winapp2.ini it needs to be tested by others so I'm asking others to help test this to see if it's safe to delete, or not. Neither BleachBit, CCleaner, or Disk Cleanup deal with these by default.

I've noticed every few days hundreds of empty zero-bytes folders created by Windows 10 in "C:\WINDOWS\System32\config\systemprofile\AppData\Local", the highest amount I had on first discovery was 900+ total with many of them being months/years old going back to 2018 and 2019 including newer ones from this year. This morning a few hundred more appeared.

I think I got CCleaner to delete them with the test cleaning routine I made listed below but I can't be 100% sure since CCleaner didn't list anything (perhaps because they were zero-bytes), and I don't have anymore of those "tw*.tmp" folders at the moment for re-testing.

For Testers Only:

[System Profile Tmp Folders *]
DetectOS=10.0|
LangSecRef=3025
Detect=HKCU\Software\Microsoft\Windows
Default=False
FileKey1=%windir%\System32\config\systemprofile\AppData\Local|tw*.tmp|REMOVESELF

[hazelnut]

@Andavari

See here (2 pages with solution)

https://www.tenforums.com/general-support/130824-tw-7f0-87c-tmp-folders.html

[CSGalloway]

A long time ago someone had sent me a batch file to split the rules in each INI file - think it was called Splitrules.bat - and I can not find where that is so would greatly appreciate it again please....

[Andavari]

10 hours ago, hazelnut said:

@Andavari

See here (2 pages with solution)

https://www.tenforums.com/general-support/130824-tw-7f0-87c-tmp-folders.html

 

That topic states those folders are "eventually deleted by Windows", although I had tons of them dating back to 2018 when I had originally bought my laptop.

Windows Defender auto-updated while I was away from the laptop for ten minutes and I had almost one hundred more of those empty folders. That CCleaner cleaning routine I made is actually deleting them as intended, although CCleaner shows nothing to confirm it has successfully got rid of them.

[APMichael]

@dvdbane
Most entries for "Metro Apps" clean up the "AC\Temp" folder, so this should be safe. I think we can add this to Winapp2.ini.

 

@CSGalloway
https://github.com/MoscaDotTo/Winapp2/issues/391

 

@Andavari
The FileKey of your entry should work, but I would still recommend the "official" syntax:

FileKey1=%WinDir%\System32\config\systemprofile\AppData\Local\tw-*.tmp|*.*|REMOVESELF

 

To make sure that only empty folders are deleted, a "fake" file pattern can be used:

FileKey1=%WinDir%\System32\config\systemprofile\AppData\Local\tw-*.tmp|empty.check|REMOVESELF

[siliconman01]

The code below worked fine on my systems.

[System Profile Tmp Folders *]
DetectOS=10.0|
LangSecRef=3025
Detect=HKCU\Software\Microsoft\Windows
Default=False
FileKey1=%WinDir%\System32\config\systemprofile\AppData\Local\tw-*.tmp|empty.check|REMOVESELF

 

[Andavari]

I'll give your re-worked cleaning routine a try when Windows decides to make more of those empty folders.

Learnt something new, I didn't know anything about an "empty.check".

[APMichael]

Just for your information: The "empty.check" is not a new function, but only a fantasy file pattern. You can use any file pattern you like, which is normally never used by programs (examples: "abc.xyz" or "no.content").

By the way, the culprit really seems to be the "Microsoft Provisioning".

[Andavari]

siliconman01's revised cleaning routine is working for me!

[SMalik]

New Entry

[Activity History *]
DetectOS=10.0
LangSecRef=3025
Detect=HKCU\Software\Microsoft\Windows
Default=False
FileKey1=%LocalAppData%\ConnectedDevicesPlatform\L.*|*.*|RECURSE

[siliconman01]

1 hour ago, SMalik said:

New Entry

[Activity History *]
DetectOS=10.0
LangSecRef=3025
Detect=HKCU\Software\Microsoft\Windows
Default=False
FileKey1=%LocalAppData%\ConnectedDevicesPlatform\L.*|*.*|RECURSE

I tested this on my system and CCleaner cannot remove the files because they are in use.  I assume the system has to be running in Safe Mode for these to be deleted ??  

If I try to delete the files manually, it shows what is using these files.

Edited March 28, 2020 by siliconman01
Manual Deletion attempt

[Winapp2.ini]

7 hours ago, siliconman01 said:

I tested this on my system and CCleaner cannot remove the files because they are in use.  I assume the system has to be running in Safe Mode for these to be deleted ??  

If I try to delete the files manually, it shows what is using these files.

They're being used by the Connected Devices Platform (user) service. Stopping it should allow the files to be deleted. Not sure if you'd need to stop the parent service (Connected Devices Platform) too

[don_dolarson]

I'd like to suggest new entry to the database.

It's an update .exe file of updated Process Hacker application (nightly v3). The file is located in the root installation folder of Process Hacker C:\Program Files\Process Hacker\processhacker-setup.exe which is created every time after an update.

[SMalik]

Revised Entry

On a Windows 10 with an Offline account, this location is with the user name and on Windows 10 with an Online account this location is with random numbers.

%LocalAppData%\ConnectedDevicesPlatform\L.user name
%LocalAppData%\ConnectedDevicesPlatform\3bbbae90f227f2fe

[Activity History *]
DetectOS=10.0
LangSecRef=3025
Detect=HKCU\Software\Microsoft\Windows
Default=False
FileKey1=%LocalAppData%\ConnectedDevicesPlatform\*|*.db;*.db-shm;*.db-wal

[SMalik]

On 28/03/2020 at 09:01, Winapp2.ini said:

They're being used by the Connected Devices Platform (user) service. Stopping it should allow the files to be deleted. Not sure if you'd need to stop the parent service (Connected Devices Platform) too

Yes, you are right.

Activity History keeps track of the things you do on your computer, such as apps and services you use and websites you browse.

[siliconman01]

7 hours ago, SMalik said:

Revised Entry

On a Windows 10 with an Offline account, this location is with the user name and on Windows 10 with an Online account this location is with random numbers.

%LocalAppData%\ConnectedDevicesPlatform\L.user name
%LocalAppData%\ConnectedDevicesPlatform\3bbbae90f227f2fe

[Activity History *]
DetectOS=10.0
LangSecRef=3025
Detect=HKCU\Software\Microsoft\Windows
Default=False
FileKey1=%LocalAppData%\ConnectedDevicesPlatform\*|*.db;*.db-shm;*.db-wal

This code works fine.  I run with Offline accounts.  I have to stop services "CDPUserSvc_44dec" and "Connected Devices Platform Service" prior to cleaning.  The caches load back up when the services are restarted or the system is rebooted.  Should a Warning message be added such as:

Warning=Stop Services "CDPUserSvc_44dec" and "Connected Devices Platform Service" prior to cleaning. Restart after cleaning

[siliconman01]

New entry:  [CobraTek PC Info Logs *]

[CobraTek PC Info Logs *]
Detect=HKCU\Software\CobraTek\PC Info
LangSecRef=3024
Default=False
FileKey1=%LocalAppData%\CobraTek\PC Info\ChangeLog|*.txt
FileKey2=%LocalAppData%\CobraTek\PC Info\Log|*.*

 

[APMichael]

Thanks for the new/revised entries, suggestions and replies.

Winapp2.ini update:
https://github.com/MoscaDotTo/Winapp2/commit/3a19c2fc3dc9cf26bfd93f0bb20f5dd19209df05

Winapp3.ini update:
https://github.com/MoscaDotTo/Winapp2/commit/f212def9545fe82aa2f3cccd31a9665415e75c31

[ricktendo64]

Thanks, note the following can be removed from winapp3.ini "All App Packages"

[All App Packages *]
...
FileKey10=%LocalAppData%\Packages\*\AC\NVIDIA Corporation\NV_Cache|*.*